Albin D. (controller) – €1,200 Fine (Austria, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
An employee at a care facility took and shared photos of two patients without permission, which revealed their health conditions. This incident highlights the importance of protecting sensitive information, especially in care settings. The employee acted outside his job duties, leading to a ruling that he was responsible for the data breach.
What happened
An employee used his personal phone to take and share photos of patients that showed their health conditions without consent.
Who was affected
Two patients at a care facility whose health information was exposed through unauthorized photos.
What the authority found
The authority ruled that the employee was responsible for the data processing as he acted outside his work duties and did not have a valid legal basis for sharing the photos.
Why this matters
This case emphasizes that individuals can be held accountable for mishandling sensitive data, even if they are employees. Organizations should ensure strict policies and training on data privacy to prevent similar incidents.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Entities Involved
Source checks
Secondary-source text retrieved.
Automated check recorded — 7 October 2026.
Processing notes: articles corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The employee, acting as a controller, was working for a rescue and aid organisation that operated a care facility for people with special needs. Between 1 December and 19 December 2025, he used his private smartphone to photograph two patients in wheelchairs. Their physical impairments and their use of care or health services were visible in the pictures, meaning that the images revealed information about their health. The images were shared to third parties through a chat application. The controller made the decision to take and disclose the photographs himself, acted outside his work duties and did not pursue any purpose connected with caring for the patients or operating the facility. The organisation informed the DPA of the incident. First, the DPA held that taking the pictures constituted the collection or recording of personal data, while sharing them through a chat application constituted disclosure by transmission or another form of making the data available under Article 4(2) GDPR, which qualifies both as processing data. Second, the authority held that the employee, rather than the organisation, was the controller under Article 4(7) GDPR as he determined the purposes and means of the processing, used his private smartphone and acted outside the scope of his duties for his own purposes. The organisation was therefore not the controller for this processing. Third, it held that the photographs contained health data under Article 4(15) GDPR. The patients appeared as persons receiving care in a specialised facility, and the photographs revealed their physical impairments and use of care or health services. The processing therefore concerned a special category of personal data. Fourth, the DPA considered that lawful processing had to comply with the principles in Article 5(1) GDPR and have a legal basis under Article 6(1) GDPR. Because the photographs contained health data, the processing also required an applicable exception under Article 9(2) GDPR. It found
Related Enforcement Actions (0)
No other enforcement actions found for Albin D. (controller) in AT
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Albin D. (controller) - Austria (2026). Retrieved from cookiefines.eu
Last updated: